Quick Tour

This is the speed-run. Open Probe alongside this page — the goal is to know where everything lives in about a minute.

The three-column layout

The whole app is one window divided into three resizable columns:

┌────────────┬───────────────────┬──────────────────┐
│            │                   │                  │
│  Sidebar   │    Log table      │  Detail panel    │
│            │                   │                  │
│  (240–400) │   (200–900)       │   (remainder)    │
│            │                   │                  │
└────────────┴───────────────────┴──────────────────┘

Drag the column dividers to resize. Probe remembers your widths between launches.

The sidebar is a vertical stack of sections you can collapse and expand:

Navigation — top of the sidebar.
- All with a domain tree underneath. Subdomains group under their root domain (api.example.com lives under example.com). Right-click any node to favorite, ignore, or watch it.
- Devices — phones, tablets, and other LAN clients. Only IP addresses appear here; localhost traffic from your own apps is shown by process name in the log table instead.
- Favorites — domains you’ve starred.
- Ignored — domains you’ve hidden, with a + button to add a new one by name.
Filter Folders — saved filter shortcuts. Each folder runs a stored search and shows the matching requests.
Saved — the on-disk session store. Saved sessions are read-only.

Log table (center)

The middle column is the live list of captured requests. It has three controls above the table:

Search box — substring match against URLs in real time.
View mode toggle — switches between Sequence (flat chronological list) and Structure (tree grouped by domain and path).
Session tabs — browser-style tabs at the top. One tab is always the recording tab; saved tabs are read-only and don’t accept new traffic. A * indicator means unsaved changes.

Right-click any row for quick actions: favorite/unfavorite the domain, ignore it, copy as cURL, replay in Composer, create a Map Local rule, or attach a breakpoint or throttle rule.

Detail panel (right)

When you click a row, the right column fills in. It has:

A method badge (GET, POST, etc.) and the full URL — selectable text so you can copy fragments.
A star toggle to favorite the domain.
Three tabs: Request, Response, and Summary.

The Summary tab is worth a second look — it has collapsible sections for overview, timing (DNS / connect / TLS / send / wait / receive), size (request bytes, response bytes, total), and connection (resolved remote address, protocol version).

The detail panel has its own search bar that highlights matches across headers, params, and body, with next/prev navigation between hits.

The toolbar runs along the top of the window. It’s split into a left cluster and a right cluster.

macOS
Windows

Left side (window title area):

App name and version
Start / Stop — toggles the proxy. Stopping also restores your system proxy.
Clear — empties the log table for the current session.
Status card — shows IP:port and CA URL.
Certificate shield — quick access to the CA download landing page.
Proxy / Compose toggle — flips the main view between the live log and the Composer.

Right side:

Throttle (icon-only) — bandwidth and latency simulation.
Watched Domains (eye icon) — manage Domain Watch list.
Scripting — open the script rules window.
Breakpoints — open the breakpoint rules window.
Import — load a session, Postman collection, or HAR file.
Settings (gear) — preferences, theme, locale, default view.

Sequence vs Structure

The view-mode toggle in the log table changes how requests are grouped:

Sequence is a flat chronological list. New rows append at the bottom. This is the right view when you’re watching live traffic and want to see exactly what fired and in what order.
Structure groups requests into a tree by domain, then path. https://api.example.com/v1/users and https://api.example.com/v1/orders both nest under api.example.com → v1. Counts next to each node show how many requests matched.

Switch any time without losing data — both modes show the same underlying log.

The Compose tab

The toolbar’s Proxy / Compose toggle flips between two modes of the same window:

Proxy is what you’ve been looking at — the live log and detail panel.
Compose is the request builder. Tabs along the top hold collections; each request has method, URL, params, headers, body, auth, and a script. Hit Send and the response appears next to the request, just like a normal HTTP client.

Composer requests use the same proxy core, environments, and scripting engine as captured traffic. Anything you set up for inspection (Domain Watch, breakpoints, throttle rules) applies to Composer requests too — including yourself.

Keyboard shortcuts

The handful you’ll use daily:

Action	macOS	Windows
Save current session	`Cmd+S`	`Ctrl+S`
Open Settings	`Cmd+,`	`Ctrl+,`
Watched Domains manager	`Cmd+Shift+D`	`Ctrl+Shift+D`
Manage Environments	`Cmd+Shift+E`	`Ctrl+Shift+E`
Toggle fullscreen	`Ctrl+Cmd+F`	`F11`
Super Search palette	`Cmd+F`	`Ctrl+F`

A complete list lives under Keyboard Shortcuts.

What to learn next

You now know where every section of the app lives. The pages below dive into individual features in order of how often you’ll reach for them.

First Capture Walk through capturing a real request end to end.

Certificate Setup Trust the CA so HTTPS bodies are readable.

Sequence vs Structure When each view mode helps and how the tree groups.

Composer Build, save, and replay requests from scratch.